CCSP Practice Exam 52 — 20 Questions

Question 1

A cloud engineer is configuring logging for an AWS Lambda function that processes sensitive data. The security team requires that all invocations are logged, including the request and response payloads, and that logs are retained for 90 days. Which action should the engineer take?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Configure the Lambda function to log to Amazon CloudWatch Logs and set the log group retention to 90 days.. To log all invocations with request and response payloads, the Lambda function must write logs to CloudWatch Logs. This is done by including logging statements in the function code. CloudWatch Logs allows setting a retention policy of 90 days. CloudTrail, X-Ray, and AWS Config do not capture full payloads, so they are not suitable.

Answer

Enable AWS X-Ray tracing for the Lambda function and configure a 90-day retention for X-Ray traces.

Answer

Use AWS Config to record Lambda function configurations and set a 90-day retention for configuration history.

Answer

Enable AWS CloudTrail logging for the Lambda function and configure a CloudWatch Logs retention policy of 90 days.

Question 2

A multinational corporation uses a cloud-based data warehouse. The security team must ensure that data is irreversibly destroyed when it is no longer needed, even across backups and replicas. The cloud provider offers a cryptographic erase feature. What is the MOST important consideration when relying on cryptographic erase?

Accepted Answer

The keys used for encryption must be securely destroyed and not recoverable.. Cryptographic erase relies on destroying the encryption keys so that data becomes permanently unrecoverable. The critical factor is ensuring that all copies of the keys are destroyed and cannot be restored from backups or escrow. Without key destruction, the data remains accessible. Other options are either irrelevant or address different sanitization methods.

Answer

The data must be overwritten with random patterns before key destruction.

Answer

The encryption algorithm must be AES-256.

Answer

The cloud provider must certify that all storage media are physically destroyed.

Question 3

A multinational bank uses a cloud provider for a system that processes customer transactions. A regulator asks the bank to demonstrate that it maintains effective control over the data and can meet its legal obligations even if the provider fails. Which activity best demonstrates that the bank has retained accountability for the outsourced processing?

Accepted Answer

Maintaining a documented risk assessment and control mapping that assigns responsibility for each obligation. Retaining accountability requires documented governance: a risk assessment covering the outsourced activity, a mapping of legal obligations to controls, and clear assignment of responsibility between the bank and provider. This evidence shows the regulator that the bank governs the relationship and can meet its obligations even if the provider fails. Assurance reports, indemnities, and data localization support the program but do not replace accountability.

Answer

Relying on the provider's SOC 2 Type II report as the sole evidence of control effectiveness

Answer

Requiring the provider to store all data in the bank's home country to simplify oversight

Answer

Transferring all security responsibility to the provider through an indemnification clause

Question 4

A cloud data architect is designing a tokenization solution for a payment processing platform hosted in a public cloud. The platform must store primary account numbers (PANs) while minimizing PCI DSS scope and preventing raw PAN exposure in application logs and analytics pipelines. Which TWO design elements are most critical to achieve these goals? (Choose two.)

Accepted Answer

Use a format-preserving token that replaces the PAN with a value of similar length and character set, stored in a separate token vault with strict access controls.. Tokenization at the point of capture and a format-preserving token stored in an isolated vault are the two critical elements. Early tokenization keeps raw PANs out of logs, queues, and analytics, while format preservation allows existing systems to process tokens without redesign. The vault separation ensures that even if downstream systems are compromised, the original PANs remain protected.

Answer

Ensure the tokenization service is deployed in the same network subnet as the analytics platform to reduce latency for token lookups.

Answer

Use reversible encryption with a shared symmetric key for the PAN and store the key in the application configuration file for operational simplicity.

Answer

Store the token-to-PAN mapping in the same database as the tokenized transaction records to simplify joins and reporting.

Question 5

A cloud security team is reviewing access controls for a storage bucket containing sensitive data. They want to ensure that only authorized users can access the data and that access is logged for auditing. Which cloud-native mechanism should they implement?

Accepted Answer

Identity and Access Management (IAM) policies with logging enabled. IAM policies with logging enabled provide both access control and auditability by defining permissions and recording access events. Network ACLs, bucket policies without logging, and encryption do not fully satisfy the requirement to control and log user access to the data.

Answer

Encryption at rest with key rotation

Answer

Network Access Control Lists (ACLs) with flow logs

Answer

Storage bucket policies with versioning enabled

Question 6

A cloud security administrator is configuring access to a cloud storage bucket that contains regulated data. The administrator needs to ensure that data is encrypted at rest using keys that are automatically rotated every 90 days. Which cloud service feature should the administrator use?

Accepted Answer

Server-side encryption with customer-managed keys in a cloud KMS.. Customer-managed keys in a cloud KMS enable automatic rotation with a configurable schedule, satisfying the 90-day requirement. Provider-managed keys rotate automatically but without customer control over the interval. Client-side and customer-provided keys require manual rotation. Thus, the KMS option is the correct choice.

Answer

Client-side encryption with a locally stored key.

Answer

Server-side encryption with customer-provided keys (SSE-C).

Answer

Server-side encryption with provider-managed keys (SSE-S3 or equivalent).

Question 7

A cloud security team is implementing tokenization for a payment system. Which THREE statements correctly describe tokenization characteristics?

Accepted Answer

The original sensitive data is stored in a secure token vault.. Option B is correct because tokenization requires a secure token vault (a protected data store, often encrypted and access-controlled) that maps each token back to its original sensitive value, such as a PAN, so the real data is never held in the transaction environment. Option C is correct because a token is a randomly generated surrogate value (for example, a 16-digit number) that has no mathematical or algorithmic relationship to the original data, unlike ciphertext produced by encryption. Option D is correct because the token can be passed through payment and business processes in place of the real data, allowing transactions to complete without exposing the original sensitive value. Option A is not correct as stated because tokenization itself is a substitution technique, not an encryption algorithm, even though encryption is often used to protect the vault. Option E is not correct because detokenization requires access to the token vault and its mapping; the token alone cannot reverse the process.

Answer

Tokenization uses encryption algorithms to protect data.

Answer

Tokenization is reversible using the token alone.

Question 8

A multinational corporation stores trade secrets in a cloud object storage bucket. The security team wants to ensure that even if the cloud provider's internal systems are compromised, the data remains confidential. They also need to maintain the ability to revoke access to specific data objects without affecting other objects. Which combination of techniques should they implement?

Accepted Answer

Client-side encryption with per-object keys and a key management system that supports granular key revocation.. Client-side encryption with per-object keys ensures that data is encrypted before it reaches the cloud, so a provider compromise does not expose plaintext. Per-object keys allow revoking access to a specific object by revoking its key, without affecting other objects. This provides both confidentiality against provider compromise and granular revocation, which are the core requirements.

Answer

Transport-layer encryption (TLS) and identity-based access policies.

Answer

Server-side encryption with customer-provided keys (SSE-C) and object-level ACLs.

Answer

Server-side encryption with provider-managed keys and bucket-level access policies.

Question 9

A multinational corporation uses a cloud-based data warehouse to store aggregated analytics data. The data includes anonymized user behavior logs that, when combined with a separate dataset of user identifiers, could re-identify individuals. The security team wants to implement a data masking technique that preserves the statistical properties of the data for analytics while preventing re-identification. Which technique BEST meets these requirements?

Accepted Answer

Differential privacy that adds controlled noise to query results or data values to protect individual privacy.. Differential privacy is the only technique that provides a formal privacy guarantee while allowing accurate statistical analysis. It works by injecting noise calibrated to the sensitivity of the data, ensuring that individual records cannot be distinguished. This preserves the overall distribution and correlations, which are essential for analytics. Other techniques either destroy statistical utility or provide weaker privacy guarantees that can be compromised through auxiliary data.

Answer

Data generalization that replaces specific values with broader categories, such as age ranges instead of exact ages.

Answer

Format-preserving encryption that encrypts user identifiers while maintaining their original format.

Answer

Tokenization that replaces user identifiers with randomly generated tokens stored in a secure vault.

Question 10

A financial services firm stores sensitive customer data in an object storage bucket. The security team wants to prevent the cloud provider's administrators from accessing the plaintext data, even though the provider manages the underlying infrastructure. The firm also needs to retain full control over the encryption keys and the ability to revoke access immediately. Which approach best meets these requirements?

Accepted Answer

Implement client-side encryption where the firm generates and stores keys in its own on-premises HSM.. Client-side encryption with keys stored in an on-premises HSM ensures that the cloud provider never possesses the keys or the plaintext. This gives the firm exclusive control and the ability to revoke access instantly by withholding the key. Other methods leave key management with the provider or do not fully prevent provider access.

Answer

Use provider-managed encryption with customer-managed keys stored in the provider's KMS.

Answer

Use a cloud access security broker (CASB) to encrypt data before it reaches the bucket.

Answer

Enable server-side encryption with provider-managed keys and enforce TLS for all data transfers.

Question 11

A cloud customer is developing a data retention and deletion policy for data stored with a cloud provider. The legal team must ensure the policy addresses key contractual and regulatory considerations. Which TWO elements should the policy include? (Choose two.)

Accepted Answer

A process for the customer to request early deletion of specific data during the contract term and for the provider to confirm deletion. A robust data retention and deletion policy must include a contractual commitment for the provider to delete all customer data, including backups, after termination and to certify destruction. It should also define a process for early deletion during the contract term. These elements ensure the customer can meet regulatory retention limits and respond to data subject requests.

Answer

A provision allowing the provider to retain customer data indefinitely for its own business purposes

Answer

A right for the provider to retain data beyond the agreed retention period if it is technically difficult to delete

Answer

A clause stating that the provider may use customer data for marketing purposes after anonymization without customer consent

Question 12

A cloud security architect is designing a data retention and destruction strategy for a multi-tenant SaaS application hosted in a public cloud. The application stores customer data in a mix of block storage, object storage, and a managed database. Regulatory requirements mandate that data be irrecoverably destroyed upon customer offboarding, and that the destruction be verifiable. Which TWO of the following practices BEST support these requirements? (Choose two.)

Accepted Answer

Maintain an immutable audit log of all data destruction actions, including key deletions and storage reclamation.. Cryptographic erasure by deleting customer-specific keys ensures data is irrecoverable, and an immutable audit log provides verifiable evidence of the destruction. Together, they meet the regulatory requirements for irrecoverable and verifiable destruction in a multi-tenant cloud environment where physical media destruction is not customer-controlled.

Answer

Implement a secure overwrite process that writes random data to all blocks occupied by the customer's data.

Answer

Rely on the cloud provider's shared responsibility model to ensure physical media destruction at end-of-life.

Answer

Use data anonymization techniques to remove personally identifiable information before deletion.

Question 13

A cloud engineer must ensure that data written to a cloud block storage volume is encrypted at rest using keys the organization controls, while allowing the provider to perform snapshots. The organization wants to avoid re-encrypting data in the application and wants minimal performance impact. Which approach BEST meets these requirements?

Accepted Answer

Enable volume encryption using a customer-managed key stored in a cloud key management service, integrated with the block storage service.. Volume encryption with a customer-managed key in a cloud KMS satisfies both the at-rest encryption mandate and the key-control requirement while remaining transparent to the application. The provider can still snapshot the volume because encryption occurs at the storage layer, and performance impact is minimal. Application-level encryption and provider-managed keys fail one or more stated constraints.

Answer

Store the volume on encrypted hardware and document the provider's physical controls in the risk register.

Answer

Use provider-managed encryption with provider-owned keys and rely on the provider's compliance attestations.

Answer

Implement application-level encryption before writing blocks, managing keys in an on-premises HSM.

Question 14

A cloud security team is implementing a data loss prevention (DLP) solution for data stored in a cloud object storage service. They need to detect and prevent the upload of files containing personally identifiable information (PII). The DLP solution must inspect file contents in near real-time as objects are uploaded. Which approach is MOST effective?

Accepted Answer

Use a cloud-native DLP service integrated with the storage service to scan objects on upload.. A cloud-native DLP service integrated with the storage service can automatically scan objects as they are uploaded, detect PII, and enforce policies in near real-time. Other options either do not inspect content, prevent inspection, or use inappropriate tools. Thus, the integrated DLP service is the most effective approach.

Answer

Enable bucket logging and periodically scan logs for PII patterns.

Answer

Implement client-side encryption so that PII is encrypted before upload.

Answer

Configure a web application firewall (WAF) to inspect uploads for PII.

Question 15

A cloud security team is implementing data loss prevention (DLP) for a SaaS application that stores sensitive documents. They need to detect and prevent unauthorized sharing of documents containing personally identifiable information (PII). Which two cloud data security controls should be implemented? (Choose two.)

Accepted Answer

Data classification and labeling of documents based on content. To detect and prevent unauthorized sharing of PII in a SaaS application, the team needs both a CASB with DLP policies and data classification and labeling. The CASB provides the enforcement mechanism to inspect and control data flows, while classification and labeling identify which documents contain PII so that DLP policies can be applied effectively. Together, they form a comprehensive DLP solution.

Answer

Encryption of documents at rest with customer-managed keys

Answer

Regular security awareness training for employees

Answer

Multi-factor authentication (MFA) for all users accessing the SaaS application

Question 16

A multinational corporation uses a cloud-based data warehouse. The security team must ensure that data remains encrypted at rest and that encryption keys are automatically rotated every 90 days without manual intervention. The keys must be stored in a hardware security module (HSM) and be auditable. Which solution meets these requirements?

Accepted Answer

Use a cloud KMS with automatic key rotation enabled and HSM-backed keys.. A cloud KMS with automatic rotation and HSM-backed keys provides automated, policy-driven key rotation at specified intervals, ensures keys are stored in hardware security modules, and generates audit logs. This satisfies all requirements: encryption at rest, automatic 90-day rotation, HSM storage, and auditability.

Answer

Implement application-level encryption with keys stored in a local hardware security module (HSM) and rotate them manually every 90 days.

Answer

Store encryption keys in a third-party secrets manager and rotate them using a scheduled script.

Answer

Use provider-managed encryption keys and rely on the provider's default rotation schedule.

Question 17

A cloud security administrator is configuring encryption for a new cloud storage bucket that will hold archived logs. The logs are not highly sensitive but must be encrypted at rest to meet a compliance requirement. The administrator wants to minimize operational overhead and does not need to manage keys. Which encryption option is MOST appropriate?

Accepted Answer

Server-side encryption with provider-managed keys (SSE-S3 or equivalent).. For non-sensitive data with a simple encryption-at-rest requirement and a desire to minimize operational overhead, provider-managed server-side encryption is the most appropriate. It is automatic, requires no key management, and meets compliance. Customer-managed or client-side options add unnecessary complexity and cost without providing additional value for this use case.

Answer

Server-side encryption with customer-managed keys stored in a cloud KMS.

Answer

Server-side encryption with customer-provided keys (SSE-C) supplied with each API request.

Answer

Client-side encryption with keys stored on-premises in a hardware security module (HSM).

Question 18

A cloud security team is implementing a data discovery and classification solution for a multi-cloud environment. They need to identify and classify data stored in object storage buckets across AWS, Azure, and Google Cloud. The solution must automatically detect sensitive data such as personally identifiable information (PII) and protected health information (PHI). Which TWO capabilities are MOST critical for the solution to effectively classify data across these platforms? (Choose two.)

Accepted Answer

Prebuilt or customizable pattern recognition for PII and PHI, such as regular expressions and machine learning models.. The two most critical capabilities for multi-cloud data discovery and classification are the ability to access data via native APIs and the ability to recognize sensitive data patterns. Native API integration enables the solution to enumerate and sample objects across different cloud storage services. Pattern recognition, including regular expressions and machine learning, allows accurate identification of PII and PHI. Together, these enable effective classification. Other options are either post-classification actions or unrelated security controls.

Answer

Integration with a SIEM to forward all classification events for real-time alerting.

Answer

The ability to automatically remediate misclassified data by moving it to a secure bucket.

Answer

The ability to enforce encryption at rest using provider-managed keys on all discovered buckets.

Question 19

A cloud security architect is designing a data retention and deletion strategy for a SaaS application hosted in a public cloud. The organization must ensure that data is securely deleted when no longer needed, and that deletion is verifiable. Which two practices should be implemented? (Choose two.)

Accepted Answer

Use cryptographic erasure by destroying the encryption keys associated with the data.. Cryptographic erasure destroys keys to make data unrecoverable, and automated retention policies with logging provide verifiable deletion. Together, they ensure data is securely deleted and that deletion can be audited. These practices are well-suited to cloud environments where physical media control is absent.

Answer

Rely on the cloud provider's standard data deletion process as specified in their SLA.

Answer

Overwrite data with zeros before deletion to ensure it cannot be recovered.

Answer

Store all data in a single cloud region to simplify deletion.

Question 20

A financial services company stores sensitive data in a cloud provider's object storage. The security team wants to enforce that all data is encrypted at rest using keys that the company controls, and that the cloud provider cannot access the plaintext keys. Which cloud data security control should they implement?

Accepted Answer

Client-side encryption where the company encrypts data before uploading and manages its own keys outside the cloud provider's infrastructure.. Client-side encryption is the only option that guarantees the cloud provider never has access to plaintext keys, because encryption and key management occur entirely within the company's environment. Server-side options, even with customer-provided keys or HSMs, involve the provider in key handling, which introduces potential access.

Answer

Server-side encryption with provider-managed keys (SSE-CMK) where the provider generates and stores the keys in its own KMS.

Answer

Server-side encryption with a hardware security module (HSM) where the provider manages the HSM and the keys are stored in the provider's key store.

Answer

Server-side encryption with customer-provided keys (SSE-C) where the company supplies the key with each request but the provider stores it temporarily.